Inside story on how HP implemented the TippingPoint intrusion prevention system across its own security infrastructure

The high cost of unwanted intrusion and malware across corporate networks is well known. Less talked-about are the successful ways that organizations are thwarting ongoing, adaptive and often-insider-driven security breaches.

Companies are understandably reluctant to readily discuss either their defenses or mishaps. Yet HP, one of the world's largest companies, is both a provider and a practitioner of enterprise intrusion prevention systems (IPS). And so we asked HP to explain how it is both building and using such technologies, along with seeking some insider tips on best practices.

And so the next edition of the HP Discover Podcast Series explores the ins and outs of improving enterprise intrusion prevention. We learn how HP
and its global cyber security partners have made the HP Global Network
more resilient and safe. We also gain more insight into HP's vision for security and learn how that has been effectively translated into actual implementation.

Gardner:
What are some of the
major trends that are driving the need for better intrusion detection and prevention nowadays?

O’Shea:
If you look at the past, you had reaction
technologies. We had firewalls that blocked and looked at the port
level. Then we evolved to trying to detect things that were malicious
with intent by using IPS.
But that was still a reactionary-type thing. It was a nice approach, but we
were reacting. But if you knew it was
bad, why did we let it in in the first place?

The
evolution was in the IPS, to the prevention. If you know it's bad, why do you
even want to see it? Why do you want to try to react to it? Just block
it early. That’s the trend that we’ve been following.

Gardner:
But we can’t just have a black-and-white entry. We want access control, rather than just a firewall.
So is there a new thinking, a new vision, that’s been developed over
the past several years about these networks and what should or shouldn't
be allowed through them?

O’Shea: You’re talking
about letting the good in. Those are the evolutions and the trends that
we are all trying to strive for. Let the good traffic in. Let who you
are be a guide. Maybe look at what you have. You can also explore the health of your
device. Those are all trends that we’re all striving for now.

Gardner: I recall Jim, that there was a Ponemon Institute report about a year or so ago that really outlined some of the issues
here.

Gardner: I suppose what’s also different nowadays is that we’re not only
concerned with outside issues in terms of risk, but also insider attacks.

O’Shea: You’re exactly
right. Are you hiring the right people? That’s a big issue. Are they
being influenced? Those are all huge issues. Big data
can handle some of that and pull that in. Our approach on intrusion detection isn’t to just look at what’s coming from the outside, but also look at all data traversing the network.

You have a whole rogue wireless-type approach in which people can gain access and can they probe and poke around.

When we deployed the TippingPoint solution,
we didn’t change our policies or profiles that we were deploying based
on whether it’s starting on the inside or starting on the outside.
It was an equal deployment.

An insider attack could
also be somebody who walks into a facility, gains physical access, and
connects to your network. You have a whole rogue wireless-type approach
in which people can gain access and can they probe and poke around. And
if it’s malware traffic from our perspective, with the IDS we took the
approach, inside or outside -- doesn’t matter. If we can detect it, if we
can be in the path, it’s a block.

TippingPoint technology is an appliance-based
technology. It’s an inline device. We deploy it inline. It sits in the
network, and the traffic is flowing through it. It’s looking for
characteristics or reputation on the type of traffic, and reputation is a
more real-time change in the system. This network, IP address, or URL
is known for malware,
etc. That’s a dynamic update, but the static updates are
signature-type, and the detection of vulnerability or a specific exploit
aimed at an operating system.

So intrusion prevention
is through the detection of that, and blocking and preventing that from
completing its communication to the end node.

Bigger picture

All the events get logged into HP ArcSight
to create the bigger picture. Are you seeing these type of events
occurring other places? So you have the bigger picture correlation.

Network-based
anomaly detection is the ability to detect something that is occurring
in the network and it's based on an IP address or it’s based on a flow.
Taking advantage of reputation we can insert those IP addresses,
detected based on flow, that are doing something anomalous.

It could be that they’re beaconing out, spreading a worm.
If they look like they’re causing concerns with a high degree of
accuracy, then we can put that into the reputation and take advantage of
moving blocks.

So reputation is a self-deploying
feature. You insert an IP address into it and it can self-update. We
haven’t taken the automated step yet, although that’s in the plan.
Today, it’s a manual process for us, but ideally, through application programming interfaces (APIs), we can automate all that. It works in a lab, but we haven’t deployed it on our production that way.

Gardner:
Clearly HP is a good example of a large enterprise, one of the largest in the world, with global presence, with a lot of technology, a lot of
intellectual property, and therefore a lot to protect. Let’s look at how you
actually approached protecting the HP network.

We wanted to prevent mal traffic, mal-formed traffic, malware -- any traffic with the mal intent of reaching the data center.

What’s
the vision, if you will, for HP's Global Cyber Security, when it comes
to these newer approaches? Do you have an overarching vision that then
you can implement? How do we begin to think about chunking out the
problem in order to then solve it effectively?

O’Shea:
You must be able to detect, block, and prevent as an overarching
strategy. We also wanted to take advantage of inserting a giant filter
inline on all data that’s going into the data center.
We wanted to prevent mal traffic, mal-formed traffic, malware -- any
traffic with the "mal" intent of reaching the data center.

So
why make that an application decision to block and rely on host-level
defenses, when we have the opportunity to do it at the network? So it
made the network more hygienically clean, blocking traffic that you
don’t want to see.

Because this is all an inline technology, and
you are going inline in the network, you’re changing flows. It
could be mal traffic, but yet maybe a researcher is trying to do
something. So we need to have the ability to have that level of
partnership with the network team. They have to see it. They have to
understand what it is. It has to be manageable.

When we
deployed it, we looked at what could go wrong and we designed around
that. What could go wrong? A device failed. So we have an N+1
type installation. If a single device fails, we’re not down, we are not
blocking traffic. We have the ability to handle the capacity of our
network, which grows, and we are growing, and so it has to be built for
the now and the future. It has to be manageable.

It
has to be able to be understood by “first responders,” the people that
get called first. Everybody blames the network first, and then it's the
application afterward. So the network team gets pulled in on many
calls, at all types of hours, and they have to be able to get that view.

That
was key to get them broad-based training, so that the technology was
there. Get a process integrated into how you’re going to handle updates
and how you’re going to add beyond what TippingPoint recommended.
TippingPoint makes a recommendation on profiles and new settings. If we
take that, do we want to add other things? So we have to have a global
cyber-security view and a global cyber-security input and have that all
vetted.

The application team had to be onboard and
aware, so that everybody understands. Finally, because we were going
into a very large installed network that was handling a lot of different
types of traffic, we brought in TippingPoint Professional Services and
had everything looked at, re-looked at, and signed off on, so that what
we’re doing is a best practice. We looked at it from multiple angles and
took a lot of things into consideration.

We proxy the events. That gives us the ability to have multiple ArcSight instances and also to evolve.

Gardner:
Is there something about TippingPoint and
ArcSight that provides data, views, and analytics in such a way that
it's easier for these groups to work together in ways that they hadn’t
before?

O’Shea:
One of the nice things about the way the TippingPoint events occur is
that you have a choice. You can send them from an individual IDS units
themselves or you can proxy them from the management console. Again, the
ability to manage was critical to us, so we chose to do it from the
console.

We proxy the events. That gives us the
ability to have multiple ArcSight instances and also to evolve. ArcSight
evolves. When they’re changing, evolving, and growing, and they want to
bring up a new collector, we’re able to send very rapidly to the new
collector.

ArcSight pulls in firewall logs. You can
get proxy events and events from antivirus. You can pull in that whole
view and get a bigger picture at the ArcSight console. The TippingPoint
view is of what’s happening from the inline TippingPoint and what's
traversing it. Then, the ArcSight view adds a lot of depth to that. Very flexible

So
it gives a very broad picture, but from the TippingPoint view, we’re
very flexible and able to add and stay in step with ArcSight growth
quickly. It's kind of a concert. That includes sending events on
different ports. You’re not restricted to one port. If you want to
create a secure port or a unique port for your events to go on to
ArcSight, you have that ability.

If you think back historically of how we dealt with them, those were kind of a Whac-A-Mole-type
of defenses. Something happened, and you reacted. So I guess the metric
would be that we’re not as reactionary, but do we have hard metrics to
prove that? I don’t have those.

How much volume?

Gardner:
We can appreciate the scale of what the systems are capable of. Do we
have a number of events detected or that sort of thing, blocks per
month, any sense of how much volume we can handle?

O’Shea:
We took a month’s sample. I’m trying to recall the exact number, but it
was 100 million events in one month that were detected as mal events.
That’s including Internet-facing events. That’s why the volume is high,
but it was 100 million events that were automatically blocked and that
were flagged as mal events.

The Professional Services teams have been able to deploy in a very large
network and have worked with the requirements that a large enterprise
has.

The Professional Services teams have
been able to deploy in a very large network and have worked with the
requirements that a large enterprise has. That includes standard
deployment, how things are connected and what the drawings are going to
look like, as well as how are you going to cable it up.

A
large enterprise has different standards than a small business would
have, and that was a give back to the Professional Services to be able
to deploy it in a large enterprise. It has been a good relationship, and
there is always opportunity for improvement, but it certainly has
helped.

Current trends

Gardner:
Jim, looking to the future a little bit, we know that there’s going to
be more and more cloud and hybrid-cloud types of activities. We’re
certainly seeing already a huge uptick in mobile device and tablet use
on corporate networks. This is also part of the bring-your-own-device (BYOD) trend that we’re seeing.

So
should we expect a higher degree of risk and more variables and
complication, and what does that portend for the use of these types of
technologies going forward? How much gain do you get by getting on the
IDS bandwagon sooner rather than later?

O’Shea:
BYOD is a new twist on things and it means something different to
everybody, because it's an acronym term, but let's take the view of you
bringing in a product you buy.

BYOD is a new twist on things and it means something different to everybody, because it's an acronym term.

Somebody is always going to get a new device, they are
going to bring in it, they are going to try it out, and they are going
to connect it to the corporate network, if they can. And because they
are coming from a different environment and they’re not necessarily to
corporate standards, they may bring unwanted guests into the network, in
terms of malware.

Now, we have the opportunity,
because we are inline, to detect and block that right away. Because we
are an integrated ecosystem, they will show up as anomalous events.
ArcSight and our Cyber Defense Center will be able to see those events.
So you get a bigger picture.

Those events can be then
translated into removing that node from the network. We have that
opportunity to do that. BYOD not only brings your own device, but it
also brings things you don’t know that are going to happen, and the only
way to block that is prevention and anomalous type detection, and then
try to bring it altogether in a bigger picture.